Where Did HIPAA Come From?“HIPAA Then and Now”

Peter Swire

Georgia Tech Scheller College of Business

Alston & Bird LLPIAPP-Las Vegas 2015

Overview

• Where did the HIPAA statute and regulation come from?

• Why was its scope focused only on health care providers and insurers?

• What were the trade-offs between data use and privacy in the original regulation?

• Why is HIPAA starting to seem outdated today?

Origins of Health Insurance Portability and Accountability Act

of 19961. 1996 Kennedy-Kassenbaum bill, to enable those

with pre-existing conditions to keep health insurance.

1. “Portability”2. Industry concern – that’s a burden! So, include

“administrative simplification” – standardized, electronic payments from the feds.

3. Privacy concern – wait, electronic records and no privacy or security rules for health data! So, tell HHS to create regs if Congress doesn’t act by 1999.

4. The story as of 2003 at http://peterswire.net/medical-privacy/

HIPAA Privacy Rule• Surprise! Congress couldn’t even get a privacy bill out of

subcommittee.• Proposed Privacy Rule 1999, 53,000 public comments• Final Privacy Rule 2000• President Bush enters 2001, decides to keep the Rule, with

modest changes in 2002• Compliance soon after• 2009 Recovery Act

– HI-Tech: Enforcement powers clearer, including for business associates

– Meaningful Use incentives mean (finally) shift to provider electronic records

The Scope of HIPAA

• The most important aspect of a regulatory regime: who/what is covered– If not covered, then you don’t care about all of

those super-detailed rules and compliance problems

• HIPAA had “administrative simplification” for providers and insurers who received payments from the US for Medicare, Medicaid, etc.

• Therefore, if you are not part of that payments system, then no HIPAA requirements– E.g., any website or health app is outside the

scope, unless it is part of a covered entity

Dual Purposes of HIPAA

• Data flows are essential to good health care, so don’t need patient consent for:– Treatment, Payment, and Health Care Operations– Medical research (if IRBs, de-identification,

limited data set)– Other public purposes (required by law, court

order, etc.)• Privacy is essential for patient trust and accurate

interactions with medical personnel:– Psychotherapy notes– And, in general

Fair Information Privacy Principles in HIPAA

• Notice• Opt-in consent as baseline• Access and accounting• Data security• Minimum necessary • Accountability/enforcement

Conclusion

• In 1996, dominant holders of medical information were providers and insurers– HIPAA didn’t cover a book store that sold readings about

cancer – should it apply to web sites and apps today?– Today, health care Big Data increasingly outside of the

covered entities• In 1996, the alternative to HIPAA was to have no national

health privacy rules, even as the health payment system became national and electronic

• Today, HIPAA is well established in the covered entities• But, as our panel will discuss, covered entities are

becoming a much smaller share of the data universe …